Paynetics' API Integration channel lets you build your own branded web or mobile application and deliver Paynetics payment services directly through it. You write the front-end; Paynetics provides the regulated infrastructure — payment accounts, card issuing, transfers, and acquiring — through a single REST API under your brand and your experience.
This is the channel to choose when you want full control over the product and user interface and are comfortable building and maintaining the integration yourself. If you prefer a production-ready mobile wallet that you can brand without building it, see White Label App. If you are running your own card programme on a Paynetics-sponsored BIN, see BIN Sponsorship.
What You Can Build
API Integration supports a wide range of use cases across Paynetics' product lines:
| Use Case | Products Used |
|---|---|
| Consumer fintech or neobank | Embedded Finance — IBAN accounts, virtual and physical cards, transfers |
| Corporate expense management | Embedded Finance — business accounts, commercial cards, per-card controls, real-time transaction webhooks |
| Marketplace payouts | Embedded Finance — seller accounts, batch fund loading, SEPA / Faster Payments withdrawals |
| B2B banking-as-a-service | Embedded Finance — multi-currency accounts, commercial cards, custom fees |
| Online payment acceptance | Acquiring — card acceptance, 3DS, tokenisation, AFT, OCT |
| Reward and incentive loading | Embedded Finance — funding accounts, batch card top-up |
Most partners integrate Embedded Finance. Acquiring can be added as a standalone channel or combined with Embedded Finance in the same instance.
Available Products
Embedded Finance
The core of API Integration. Gives you access to the full Paynetics platform object model: Instance → Program → Account → Balance → Card.
Payment Accounts — Open payment accounts for consumers and businesses across the EU, UK, Iceland, Norway, and Liechtenstein. Supports EUR (IBAN, SEPA), GBP (Sort Code + Account Number, Faster Payments), BGN (IBAN, BISERA), and USD (inbound SWIFT for business accounts).
Card Issuing — Issue Mastercard and Visa virtual and physical cards linked to Account Balances. Configure usage groups, velocity limits, MCC whitelists, and per-card fee groups via API. Apple Pay and Google Pay push provisioning is available for certified programmes.
Transfers — SEPA Credit Transfer, SEPA Instant, Faster Payments, CHAPS (inbound), BISERA, SWIFT (inbound), and instant internal transfers between Paynetics Accounts.
Customer Onboarding — Onboard natural persons and legal entities via the Onboarding API. Choose between Paynetics Managed KYC (Paynetics verifies using its own vendors) or Partner Managed KYC (you verify using Paynetics-approved vendors and submit results in real time).
Partner Portal — A web portal for your operations team to manage accounts, cards, and transactions without API calls: view balances, block/unblock accounts, review transaction history, and upload batch files for card issuance or customer onboarding.
See Embedded Finance Overview for the full capability reference.
Acquiring
Available as an add-on or standalone. Lets you accept card payments via a hosted payment page or direct API integration.
- Card acceptance with 3DS authentication
- Account Funding Transactions (AFT) for top-up use cases
- Original Credit Transaction (OCT) for payouts to cards
- Secure Card-on-File (SCOF) and Visa Tokenised Card-on-File (TCoF)
- Click to Pay and Apple Pay / Google Pay acceptance
How the Integration Works
API
Paynetics exposes a REST API over HTTPS. All requests are authenticated using HMAC-SHA256 signing, which requires exchanging a public PGP key with Paynetics during onboarding to receive your API key and secret. The full API reference is published at developers.paynetics.digital.
Webhooks
Real-time event notifications are delivered to your registered endpoint via HTTPS POST. Webhooks cover the full event lifecycle: account and card status changes, transaction authorisations, KYC decisions, wire transfer receipts, and more. Paynetics requires webhook endpoints to be reachable at all times with sub-10-second response times.
Sandbox
Every partner receives a dedicated Sandbox Instance prior to production access. The sandbox mirrors your production configuration: the same programme, account types, fee groups, and API endpoints. Paynetics pre-loads 10,000 currency units to your funding account for testing, and a wire-in simulator is available to test inbound transfers at any time. Physical cards cannot be issued in the sandbox.
Integration Requirements
Paynetics requires all API Integration partners to meet the following before go-live:
Two-Factor Authentication (2FA) — All user sign-in and account-recovery flows must use two factors: something the user knows (password, PIN) combined with something the user owns (OTP via SMS or email, authenticator app) or something the user is (biometric). An authorised device can count as the first factor if you can prove the transaction can only originate from it.
Strong Customer Authentication (SCA) — All payment transactions must be authorised via SCA in line with PSD2 requirements. Your SCA implementation must be audited by a certified QSA (Qualified Security Assessor) and the audit report submitted to Paynetics before go-live. Paynetics can refer you to an approved security lab.
Operations Traceability — You must implement immutable logging of all legal consents (e.g. Terms and Conditions acceptances) and all payment transaction authorisations executed via your UI. Minimum required fields per log record: operation type and details, device fingerprint, timestamp, and public IP address. Logs must be retained for at least five years and available to Paynetics within hours of a request.
Penetration Testing — A pen test by a certified QSA covering your network, infrastructure, web interfaces, mobile apps, and APIs is required before go-live. If you have a passing pen test (no medium or high severity findings) from within the last 12 months, a limited re-test scoped to the changes made for the Paynetics integration is accepted.
UAT Testing — Once sandbox integration is complete, you run a set of end-to-end integration tests defined by Paynetics to confirm data quality, business flow, KYC/AML policy compliance, and correct implementation of all agreed behaviours. Results are submitted to Paynetics for review.
Choosing a Delivery Channel
| API Integration | White Label App | BIN Sponsorship | |
|---|---|---|---|
| You build the UI | Yes — full control | No — Paynetics provides a brandable mobile app | Not applicable — card programme, no app required |
| Best for | Custom web or mobile products, complex use cases, full UX ownership | Fast time-to-market for a consumer mobile wallet | Partners running their own card programme |
| Products available | Embedded Finance + Acquiring | Digital Wallet (Issuing or Invite-Only) | Card issuing on partner-owned BIN |
| Integration effort | High — you build and maintain the client | Low — branding and configuration only | Medium — API for card lifecycle and user management |
| Regulatory requirements | SCA audit, pen test, 2FA, traceability | Handled by Paynetics (app is SCA-certified) | Programme Manager obligations; no separate SCA audit |
Getting Started
The integration journey follows the standard Paynetics partner process:
- Pre-vetting — Paynetics performs initial due diligence on your business and use case.
- Product definition — You define your payment products (programmes, account types, card products, fees, limits) with your assigned Project Manager. These are configured in your Sandbox Instance.
- Technical integration — Your engineering team implements against the Sandbox API, supported by Paynetics technical engineers.
- Compliance and legal — Underwriting review, SCA audit, pen test, marketing materials approval, and legal agreements run in parallel with technical integration.
- UAT — End-to-end testing against a defined test suite.
- Go-live — Production environment provisioned; all checklist items closed.
For the full timeline and milestone breakdown, see Partner Journey Overview. For what happens at go-live and beyond, see Go-Live.